Broly

README

Broly

Berserker product security scanner. Secrets, SCA, and SAST in a single binary.

Install

Download a pre-built binary from Releases, or build from source:

brew install vectorscan   # build dependency
git clone https://github.com/Shasheen8/Broly.git
cd Broly && make build

Usage

broly scan                          # scan current directory
broly scan /path/to/project         # scan specific path
broly scan --secrets                # secrets only
broly scan --sca                    # SCA only
broly scan -f json                  # JSON output
broly scan -f sarif -o results.sarif
broly scan --min-severity high
broly scan --sca --offline          # skip OSV API

What It Finds

Secrets — 100 rules, entropy filtering, Hyperscan engine

AWS, GitHub, OpenAI, Anthropic, GCP, Azure, Cloudflare, Slack, Stripe, Twilio,
SendGrid, Docker, npm, SSH/PGP/RSA/EC keys, database URIs, JWTs, generic tokens

SCA — 19 ecosystems, 50+ lockfile formats, OSV.dev

Go, Python, JavaScript, Ruby, Rust, Java, PHP, .NET, Dart, C/C++, Haskell,
Elixir, Erlang, R, Swift, Lua, Nim, OCaml, Julia — including Go stdlib vulns

SAST — tree-sitter AST analysis, coming in v0.2

Output Formats

Format	Flag
Table (default)	-f table
JSON	-f json
SARIF 2.1.0	-f sarif

Exit Codes

Code	Meaning
0	No findings
1	Findings detected
2	Error

Acknowledgments

• Poltergeist — secrets engine
• osv-scalibr — lockfile extraction
• osv.dev — vulnerability database

License

MIT